Issues

• Security report — possible pull_request_target + checkout-head RCE (please contact privately)

  step-security/github-actions-goat#263 · Filter by author Raffa-jarrl opened on May 19, 2026

• Harden GitHub Actions Workflow - tj-actions-changed-files-incident.yaml

  step-security/github-actions-goat#251 · Filter by author stepsecurity-int opened on Mar 15, 2025

• Harden GitHub Actions Workflow - changed-files-vulnerability-with-hr.yml

  step-security/github-actions-goat#241 · Filter by author stepsecurity-int opened on Feb 13, 2025

• Harden GitHub Actions Workflow - block-dns-exfiltration.yaml

  step-security/github-actions-goat#240 · Filter by author stepsecurity-int opened on Feb 13, 2025

• Harden GitHub Actions Workflow - baseline_checks.yml

  step-security/github-actions-goat#239 · Filter by author stepsecurity-int opened on Feb 13, 2025

• Harden GitHub Actions Workflow - PRTargetWorkflow.yml

  step-security/github-actions-goat#238 · Filter by author stepsecurity-int opened on Feb 13, 2025

• Harden GitHub Actions Workflow - toc-tou.yml

  step-security/github-actions-goat#237 · Filter by author stepsecurity-int opened on Feb 13, 2025

• Harden GitHub Actions Workflow - publish.yml

  step-security/github-actions-goat#236 · Filter by author stepsecurity-int opened on Feb 13, 2025
  1

• Harden GitHub Actions Workflow - changed-files-vulnerability-without-hr.yml

  step-security/github-actions-goat#235 · Filter by author stepsecurity-int opened on Feb 13, 2025
  1

• Add threat related to modification of artifact in storage/ release location

  step-security/github-actions-goat#80 · Filter by author varunsh-coder opened on Apr 30, 2022

• Add a tutorial for secrets in build logs

  step-security/github-actions-goat#54 · Filter by author varunsh-coder opened on Feb 9, 2022

• Investigate checkspelling token leak

  incident
  step-security/github-actions-goat#34 · Filter by author varunsh-coder opened on Jan 24, 2022